Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have the following string produced by a server log file. I am using Simple Event Correlator (which uses perl regex) to manipulate lines:

18:37:31 643.65.123.123 []sent /home/mydomain/public_html/court-954fdw/Chairman-confidential-video.mpeg 226 court-954fdw@mydomain.com 256

and I have been successful in using perl regex to successfully extract the user who logs in with the following pattern.

NOTE: the values that SEC uses are extracted from the data contained in the parenthesis:

pattern=sent \/home\/mydomain\/public_html\/(.*)\/(.*)

However, I have been unsuccessful in parsing out just the file name which in this case would be: Chairman-confidential-video.mpeg.

Currently the existing pattern I use pulls out the entire string:

Chairman-confidential-video.mpeg 226 court-954fdw@mydomain.com 256

which I don't want. Any help much appreciated.

share|improve this question

2 Answers 2

I would probably use:

pattern=sent \/home\/mydomain\/public_html\/(.*)\/(\S+).*

This should extract out all but whitespace characters for the last capturing match, and leave the rest for the non-capturing match.

share|improve this answer

I'd use the following:

pattern=sent \/home\/mydomain\/public_html\/(.*?)\/\(.* ?)\S*.*$

For more explicit non-greedy matching. Your result will now be in $2. This assumes that you can't hard-code anything below public_html. This does leave a trailing space.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.